Open Bisimulation for Quantum Processes 



(N 



p 

O 

(N 



Yuxin Deng^ Yuan Feng^ 
^Shanghai Jiao Tong University, China 
^ University of Technology, Sydney, Austraha, and Tsinghua University, China 

January 4, 2012 



Abstract 



o 

pH ' Quantum processes describe concurrent communicating systems that may involve quantum infor- 

I mation. We propose a notion of open bisimulation for quantum processes and show that it provides 

both a sound and complete proof methodology for a natural extensional behavioural equivalence be- 
' tween quantum processes. We also give a modal characterisation of open bisimulation, by extending the 

Hennessy-Milner logic to a quantum setting. 

2 '. 1 Introduction 

^ I The theory of quantum computing has attracted considerable research efforts in the past twenty years. Ben- 

efiting from the superposition of quantum states and linearity of quantum operations, quantum computing 
may provide considerable speedup over its classical analogue [39, 14, 15]. However, functional quantum 
^ . computers which can harness this potential in dealing with practical applications are extremely difficult 

' to implement. On the other hand, quantum cryptography, of which the security and ability to detect the 

presence of eavesdropping are provable based on the principles of quantum mechanics, has been developed so 
' rapidly that quantum cryptographic systems are already commercially available by a number of companies 

such as Id Quantique, Cerberis, MagiQ Technologies, SmartQuantum, and NEC. 

As is well known, it is very difficult to guarantee the correctness of classical communication protocols 
at the design stage, and some simple protocols were finally found to have fundamental fiaws. Since human 
intuition is poorly adapted to the quantum world, quantum protocol designers will definitely make more 
faults than classical protocol designers, especially when more and more complicated quantum protocols 
can be implemented by future physical technology. In view of the success that classical process algebras 
. [28, 19, 1] achieved in analyzing and verifying classical communication protocols, several research groups 

$H ' proposed various quantum process algebras with the purpose of modeling quantum protocols. Jorrand 

and Lalire [25, 27] defined a language QPAlg (Quantum Process Algebra) by adding primitives expressing 
unitary transformations and quantum measurements, as well as communications of quantum states, to a 
CCS-like classical process algebra. An operational semantics of QPAlg is given, and further a probabilistic 
branching bisimulation between quantum processes is defined. Gay and Nagarajan [12, 13] proposed a 
language CQP (Communicating Quantum Processes), which is obtained from the pi-calculus [29] by adding 
primitives for measurements and transformations of quantum states, and allowing transmission of qubits. 
They presented a type system for CQP, and in particular proved that the semantics preserves typing and 
that typing guarantees that each qubit is owned by a unique process within a system. The second author of 
the current paper, together with his colleagues, proposed a language named qCCS [9, 41, 10] for quantum 
communicating systems by adding quantum input/output and quantum operation/measurement primitives 
to classical value-passing CCS [16, 17]. One distinctive feature of qCCS, compared to QPAlg and CQP, is that 
it provides a framework to describe, as well as reason about, the communication of quantum systems which 
are entangled with other systems. Furthermore, a bisimulation for processes in qCCS has been introduced, 
and the associated bisimilarity is proven to be a congruence with respect to all process constructors of qCCS. 
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Uniqueness of the solutions to recursive process equations is also established, which provides a powerful proof 
technique for verifying complex quantum protocols. 

In the study of quantum systems, as well as classical communicating systems, an important problem is to 
tell if two given systems exhibit the same behaviour. To approach the problem we first need to give criteria 
for reasonable behavioural equivalence. Two systems should only be distinguished on the basis of the chosen 
criteria. Therefore, these criteria induce an extcnsional equivalence between systems, «bohav; namely the 
largest equivalence which satisfies them. 

Having an independent notion of which systems should, and which should not, be distinguished, one can 
then justify a particular notion of equivalence, e.g. bisimulation, by showing that it captures precisely the 
touchstone equivalence. In other words, a particular definition of bisimulation is appropriate because ~bisi, 
the associated bisimulation equivalence, 

(i) is sound with respect to the touchstone equivalence, that is si S2 implies Si Wbchav S2', 

(ii) provides a complete proof methodology for the touchstone equivalence, that is si ~bchav S2 implies 

This approach originated in [20] but has now been widely used for different process description languages; 
for example, sec [21, 34] for its application to higher-order process languages, [32] for mobile ambients, [11] for 
asynchronous languages and [5] for probabilistic timed languages. Moreover, in each case the distinguishing 
criteria are more or less the same. The touchstone equivalence should 

(i) be compositional; that is preserved by some natural operators for constructing systems; 

(ii) preserve barbs; barbs are simple experiments which observers may perform on systems [33]; 

(iii) be reduction- closed; this is a natural condition on the reduction semantics of systems which ensures 
that nondeterministic choices are in some sense preserved. 

We adapt this approach to quantum processes. Using natural versions of these criteria we obtain an 
appropriate touchstone equivalence, which we call reduction barbed congruence, ~r- We then develop a theory 
of bisimulations which is both sound and complete for sa^- Moreover, we provide a modal characterisation 
of «r in a quantum logic based on Hennessy-Milner logic [18]by establishing the coincidence of the largest 
bisimilation with logical equivalence. 

The remainder of the paper is organised as follows. In the next section we recall some preliminary concepts 
from quantum theory. In Section 3 we review the model of probabilistic labelled transition systems, based 
on which wc give the operational semantics of qCCS in Section 4. Section 5 contains the main theoretical 
results of the paper. Wc define a notion of open bisimulation, which is shown to be a congruence relation in 
the language of qCCS. It turns out that open bisimilarity precisely captures reduction barbed congruence, 
thus provides a sound and complete proof methodology for our touchstone equivalence. In addition, we 
give a modal characterisation of the equivalence in a quantum logic obtained by an extension of Hennessy- 
Milner logic with a probabilistic choice modality and a super-operator application modality. To illustrate the 
application of open bisimulation and its modal characterisation, in Section 6 we describe the key distribution 
protocol BB84 as qCCS processes and compare a specification with its implementations of the protocol. The 
paper ends with a brief comparison with related work in Section 7. 

2 Preliminaries on quantum mechanics 

In this section, we briefly recall some basic concepts from quantum theory, which requires first some notions 
from linear algebra. More details about quantum computation can be found in many books, e.g. [30]. 
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2.1 Basic linear algebra 

A Hilbert space "H is a complete vector space equipped with an inner product 
such that 

1. (7/) 1 7/)) > for any \tp) G "H, with equahty if and only ii {tp) — 0; 

where C is the set of complex numbers, and for each c € C, c* stands for the complex conjugate of c. For 
any vector \^p) € T-L, its length \\\'4>)\\ is defined to be Vv/^lW) ^-^^d said to be normalized if |||V')|| = 1- 
Two vectors \ip) and \(j}) are orthogonal if (t/'I^) =0. An orthonormal basis of a Hilbert space H is a basis 
where each \i) is normalized and any pair of them are orthogonal. 
Let £(71) be the set of linear operators on H. For any A e C{H), A is Hermitian ii A^ = A where A'^ 
is the adjoint operator of A such that (V'l^^ |(/>) = for any |0) e H. The fundamental spectral 

theorem [30] states that the set of all normalized eigenvectors of a Hermitian operator in C{7i) constitutes 
an orthonormal basis for H. That is, there exists a so-called spectral decomposition for each Hermitian A 
such that 

A = Y,^^\^){A= ^^^^ 

i \i£spec(A) 

where the set {\i)} constitutes an orthonormal basis of T-L, spec{A) denotes the set of eigenvalues of A, 
and Ei is the projector to the corresponding eigenspace of Ai. A linear operator A G is unitary if 

A'^ A = AA^ = Ifi, where I-u is the identity operator on "H. For instance, a well-known unitary operator is 
the 1-qubit Hadamard operator H defined as follows: 



V 1 -1 

The trace of ^ G 'C('H) is defined as tr{A) = ^o'' some given orthonormal basis {\i)} of H. It is 

worth noting that trace function is actually independent of the chosen orthonormal basis. It is also easy to 
check that trace function is linear and tr(^i3) = tr{BA) for any operators A,Bg Cili). 

Let %! and ^2 be two Hilbert spaces. Their tensor product Hi ®'H2 is defined as a vector space consisting 
of linear combinations of the vectors \'4^iip2) = |V'i)l'02) = IV'i) ® IV'2) with iV'i) G "Hi and 1-02) G T-L2- Here 
the tensor product of two vectors is defined by a new vector such that 




Then Hi ®T-L2 is also a Hilbert space where the inner product is defined as the following: for any IV'i), \4>i) G 
Ui and |7A2>,|02> e H2, 

(t/iI ® V2I01 «"?!'2) = ('0l|'?!>l)-Hi(V'2|02)-H2 

where {■\-)'Hi is the inner product of T-Li- For any Ai G and A2 G £('^2), Ai (E}A2 is defined as a linear 

operator in C(Hi ® H2) such that for each IV'i) G Hi and 1-02) G H2, 

(Ai (E) A2)\iJlij2) = AllV-l) ®^2|V'2). 

The partial trace of ^ G C(T-Li (E) "^2) with respected to Hi is defined as tT-u-^{A) — where {\i)} is 

an orthonormal basis of Hi- Similarly, we can define the partial trace of A with respected to H2- Partial 
trace functions are also independent of the orthonormal basis selected. 
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An operator A £ C{H) is positive if {ijj\Aip) > for every ip £ H. A linear operator £ on.C{'H) is completely 
positive if it maps positive operators in to positive operators in C{'H), and for any auxiliary Hilbert 

space 'H', the trivially extended operator Iw ® £ also maps positive operators in C{H' <8) H) to positive 
operators in C{T-L' ®T-L). Here Iw is the identity operator on C{H'). The elegant and powerful Kraus 
representation theorem [26] of completely positive operators states that a linear operator £ is completely 
positive if and only if there is some set of operators {Ei\ with appropriate dimension such that 

£{A)=Y,E.M 

i 

for any A e C{H). The operators Ei are called Kraus operators oi £. A linear operator is said to be a 
super- operator if it is completely positive and trace-nonincreasing. Here an operator £ is trace-nonincreasing 
if tr(£(A)) < tr(yl) for any positive A S C{'H), and it is said to be trace-preserving if the equality always 
holds. Then a super-operator (resp. a trace-preserving super-operator) is a completely positive operator 
with its Kraus operators Ei satisfying E\Ei < I (resp. X;, eJe, = I). We denote by SO{H) the set of 
trace-preserving super-operators on the Hilbert space Ji. 

2.2 Basic quantum mechanics 

According to von Neumann's formalism of quantum mechanics [40] , an isolated physical system is associated 
with a Hilbert space which is called the state space of the system. A pure state of a quantum system is 
a normalized vector in its state space, and a mixed state is represented by a density operator on the state 
space. Here a density operator p on Hilbert space H is a positive linear operator such that tr(p) = 1. 
Another equivalent representation of density operator is probabilistic ensemble of pure states. In particular, 
given an ensemble {{pi, IV'i))} where pi > 0, J^iPi — 1' ^'^"^ l"*^*) ^'"^ pure states, then p = J^iPdl^'i)] is a 
density operator. Here [\ipi)] denotes the abbreviation of Conversely, each density operator can be 

generated by an ensemble of pure states in this way. The set of density operators on H can be defined as 

'D{'H) = { p £ CCH) : p is positive and tr(p) = 1}. 

The state space of a composite system (for example, a quantum system consisting of many qubits) is the 
tensor product of the state spaces of its components. For a mixed state p on T-Li (g) 7^2, partial traces of p 
have explicit physical meanings: the density operators tr^^j^p and tr-^^p are exactly the reduced quantum 
states of p on the second and the first component system, respectively. Note that in general, the state of a 
composite system cannot be decomposed into tensor product of the reduced states on its component systems. 
A well-known example is the 2-qubit state 

|vi/) = -L(|oo) + |ii)). 

This kind of state is called entangled state. To see the strangeness of entanglement, suppose a measurement 
M = Ao[|0)] -I- Ai[|l)] is applied on the first qubit of |^') (see the following for the definition of quantum 
measurements). Then after the measurement, the second qubit will definitely collapse into state |0) or |1) 
depending on whether the outcome Aq or Ai is observed. In other words, the measurement on the first qubit 
changes the state of the second qubit in some way. This is an outstanding feature of quantum mechanics 
which has no counterpart in classical world, and is the key to many quantum information processing tasks 
such as teleportation [3] and superdense coding [4]. 

The evolution of a closed quantum system is described by a unitary operator on its state space: if the 
states of the system at times ti and t2 are pi and p2, respectively, then p2 = UpiW for some unitary operator 
U which depends only on ti and In contrast, the general dynamics which can occur in a physical system 
is described by a trace-preserving super-operator on its state space. Note that the unitary transformation 
U{p) = U pU'^ is a trace-preserving super-operator. 

A quantum measurement is described by a collection {Mm} of measurement operators, where the indices 
m refer to the measurement outcomes. It is required that the measurement operators satisfy the completeness 
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equation X^m -^m-^™ ^ In- If the system is in state p, then the probabihty that measurement resuh m 
occurs is given by 

and the state of the post-measurement system is AI^pM^^ / p{m) . 

A particular case of measurement is projective measurement which is usuaUy represented by a Hermitian 
operator. Let M be a Hermitian operator and 

M= (1) 

m^spec{M) 

its spectral decomposition. Obviously, the projectors {Em : m G spec(Af)} form a quantum measurement. 
If the state of a quantum system is p, then the probability that result m occurs when measuring M on the 
system is p{m) = tr{E„ip), and the post-measurement state of the system is E,npE,n/p{'m). Note that for 
each outcome m, the map 

is again a super-operator by Kraus Theorem; it is not trace-preserving in general. 

Let M be a projective measurement with Eq.(l) its spectral decomposition. We call M non-dcgencratc if 
for any m S spec{M), the corresponding projector Em is 1-dimensional; that is, all eigenvalues of M are non- 
degenerate. Non-degenerate measurement is obviously a very special case of general quantum measurement. 
However, when an ancilla system lying at a fixed state is provided, non-degenerate measurements together 
with unitary operators are sufficient to implement general measurements [30]. 

3 A probabilistic model 

In this section we review the model of probabilistic labelled transition systems (pLTSs), and some properties 
of weak transitions. Later on we will interpret the behaviour of quantum processes in terms of pLTSs. 

3.1 Probabilistic labelled transition systems 

We begin with some notation. A (discrete) probability distribution over a set S is a function A : 5 — )■ [0, 1] 
with J2seS ^(^) ~ 1' ^^^'^ support of such a A is the set [A] = { s e | A(s) > 0}. The point distribution 
s assigns probability 1 to s and to all other elements of S, so that [s] = s. We use ^{S) to denote the set 
of distributions over S, ranged over by A,Q etc. If J2keKPk = 1 for some collection of > 0, and the A^ 
are distributions, then so is J^keKPk ' with {J^keKPk ' ^k){s) = J2ieiPi ' ^i(s)- 

Definition 3.1. A probabilistic labelled transition system (pLTS) is a triple (S*, Act^, ^•), where 
(i) S is a set of states; 

(a) Act-r is a set of transition labels, with distinguished element t; 
(Hi) the relation — > is a subset of S x Act-r x 'D{S). 

In the literature essentially the same model has appeared under different names such as NP-systems 
[22], probabilistic processes [23], simple probabilistic automata [37], probabilistic transition systems [24] etc. 
Furthermore, there are strong structural similarities with Markov Decision Processes [31, 8]. 

A (non-probabilistic) labelled transition system (LTS) may be viewed as a degenerate pLTS, one in which 
only point distributions are used. 



5 



3.2 Lifting relations 



In a pLTS actions are only performed by states, in that actions are given by relations from states to distri- 
butions. But in general we allow distributions over states to perform an action. For this purpose, we lift 
these relations so that they also apply to distributions [7]. 

Definition 3.2 (Lifting). Let TZ C_ S x 'D{S) be a relation from states to distributions in a pLTS. Then 
Ti) C 'D{S) X is the smallest relation that satisfies 

(i) s TZ implies s 7?.^ Q, and 

(a) (Linearity) TZ^ Qi for i ^ L implies {J2i(£iPi ' ^i) (X)ie/P* ' f'^''^ '^^V P>- ^ i^^M 
Sie/-Pi — 1' where I is a finite index set. 

There are numerous ways of formulating this concept of lifting relations. The following is particularly 
useful. 

Lemma 3.3. A 7?.^ O if and only if there is a finite index set L such that 
ft) ^ = J2teiP^-~i' 

(li) e = Y.^^IP^ ■ 

(Hi) Si TZ Qi for each i G I. 

Proof. (<=) Suppose there is an index set / such that (i) A = J^ieiP^ ' (i^) ® ~ X^iez-P* ' (iii) 
Si TZ Qi for each i G I. By (iii) and the first rule in Definition 3.2, we have s7 7?.^ ©i for each i E L By the 
second rule in Definition 3.2 we obtain that iJ2i£iPi ' ^) iJ2ieiPi ' that is A TZ^ Q. 
(=^) We proceed by rule induction. 

• If A 7?.^ 9 because of A = s and s TZ then we can simply take / to be the singleton set {i} with 
Pi = 1 and Qi = 9. 

• If A 7Z^ 9 because of the conditions A = J^ieiP^ ' ®' ^ TliieiPi ' ®' some index set /, 
and Ai TZ'^ Qi for each i € L, then by induction hypothesis there are index sets Ji such that A^ = 
J2jeJiPij ' ©i = 12j£jiPij ' ^iji Sij TZ Qij for each i £ I and j £ Ji. It follows that 
^ = Yji(^iY.](ij,PiPij - Sij, & = Y^iei^jeJiP^Pv ■ ©U' 'ind s.^ TZ 9^ for each i e / and j e Jj. So 
it suffices to take {ij \ i £ I,j E Ji} to be the index set and {piPij \ i E L, j E Ji} be the collection of 
probabilities. 

□ 

We apply this operation to the relations in the pLTS for a E Acti-, where we also write for 
{-^)\ Thus as source of a relation we now also allow distributions. But note that s A is more 
general than s A. In papers such as [38, 6] the former is rcfercd to as a combined transition because if 
s A then there is a collection of distributions A^ and probabilities pi such that s Ai for each i E I 

and A = Y^i^iPi ' with J^ieiP^ = 1- 

In Definition 3.2, linearity tells us how to compare two linear combinations of distributions. Sometimes 
we need a dual notion of decomposition. Intuitively, if a relation TZ is left- decomposable and A 7?. 9, then 
for any decomposition of A there exists some corresponding decomposition of 9. 

Definition 3.4 (Left-decomposable). A binary relation over distributions, TZ C T>{S) x T>{S), is called 
left-decomposable if {J^ieiPi ' ®' where I is a finite index set, implies that 9 can be written as 

i12ieiPi ■ ®«) such that Ai TZ Qi for every i E I. 

Proposition 3.5. For any TZ ^ S x T>(S) the relation TZ^ over distributions is left-decomposable. 
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Proof. Suppose A = (J^ieiPi ' ^0 ^'^"^-^ ^ ®- have to find a family of 0j such that 

(i) A; 6; for each i e /, 

(ii) 0-E.e/P.-0.- 

From the alternative characterisation of lifting, Lemma 3.3, wc know that 

Define 6^ to be 

Note that A(s) can be written as J2{jeJ\ s=s - } 1j ^^^'^ therefore 

Since Sj 7^ 9j this establishes (i) above. 

To establish (ii) above let us first abbreviate the sum J2{jeJ\s=s- } 'Kfs) ' ^° ^(•®)- Then J^ieiPi ' ®j 
can be written as 

EseTAl Eie/Pi • Ai(s) •X(s) 

The last equation is justified by the fact that A(s) = J^ieiPi ' Ai(s). 
Now A{s)-X{s)=J2{je J I s=sj } 1j ' ^i^'i therefore we have 

E,e/P« ■ ©I = EsgTA] E{je,7|s=sj } ■ ©-^ 

= e 

□ 

We write s A if either s A or A = s, and s — ^ A iff s A for a e Act. For any a G Act^, 
we know that ^ C S* x 2?(5), so we can lift it to be a transition relation between distributions. With a 

slight abuse of notation we simply write A ^ 8 for A {-^) 9. Then we define weak transitions 

by letting =^ be the reflexive and transitive closure of and writing A ==> 9 for a G Act whenever 

A =^— 9. If A is a point distribution, we often write s =4» 9 instead of s ==> 9. 

Proposition 3.6. The action relations =^ are both linear and left-decomposable. 

Proof. It is easy to check that both properties are preserved by composition; that is if 72,;, i = 1, 2, are linear, 
left-decomposable respectively, then so is TZi ■ 72-2. The result now follows since is formed by repeated 
composition from two relations and which we know are both linear and left-decomposable. □ 

Let 7?. C S* X be a relation between states. It induces a speical relation IZ C S x V^S) between states 
and distributions: 

1l ~ {(s,t) I s 7^ t}. 

Then we can use Definition 3.2 to lift to be a relation {TV)' between distributions. For simplicity, we 

combine the above two lifting operations and directly write 7?,^ for ijz)^ in the sequel, with the intention 
that a relation between states can be lifted to a relation between distributions via a special application of 
Definition 3.2. Consequently, we have the following corollary of Lemma 3.3. 



7 



Corollary 3.7. Suppose TZ C S x S . Then A TZ^ Q if and only if there is a finite index set I such that 

(a) e = Y^i^iPi -ti, 

(Hi) Si TZ ti for each i Cz I. 

Relations over distributions obtained by lifting enjoy some very useful properties. The following one will 
be used in Section 5 to show the transitivity of open bisimilarity. 

Proposition 3.8. Let 72,1,72.2^ S x S be two binary relations. The forward relation {TZi ■ 72-2)^ coincides 
with TZi^ ■ 7^2^ 

Proof. We first show that {TZi ■ TZ2)^ ^ TZi^ ■ TZ-2^ ■ Suppose there are two distributions Ai, A2 such that 
Ai (7^l • 7^2)^ A2. Then we have that 

Ai = • s7, s, 7^l • 7^2 s^, ^2 = Y,p^■^^■ (2) 

i£l iei 

The middle part of (2) implies the existence of some states ti such that Si TZi ti and ti TZ s'^. Let Q be the 
distribution J^teiP^ ' It is clear that Ai 7^l■'■ 6 and QTZ2'' A2. It follows that Ai 7^lt • 7e2^ A2. 

Then we show the inverse inclusion TZi"^ ■ TZ2^ C (JZi ■ TZ2)^ ■ Given three distributions Ai, A2, A3, we 
show that if Ai TZi'' A2 and A2 TZ2^ A3 then Ai {TZi ■ 7^2)^ A3. 

First Ai TZi"^ A2 means that 

Ai = X]^'' ■ ^' ^2 = '^Pi ■ Sj- (3) 

iei iei 

Then from A2 TZ2^ A3 and Proposition 3.5, we have A3 = J^ieiPi ' ®« with TZ2^ Oi for each i € I. Now 
by Corollary 3.7, Qi can be further decomposed as O; = J2jeJi liJ ' such that TZ2 tij for each j G Ji. 
In summary, we have 

Ai = • ^ Qij ■ si, and A3 = • ^ • tij. (4) 

iei jeJi iei jeJi 

Finally it follows from (4) and the fact s^ TZi s^ 7^2 tij that Ai {TZi ■ 7^.2)^ A3. □ 

4 Quantum CCS 

We introduce the language qCCS which was originally studied in [9, 41, 10]. Three types of data are 
considered in qCCS: as classical data we have Bool for booleans and Real for real numbers, and as quantum 
data we have Qbt for qubits. Consequently, two countably infinite sets of variables are assumed: cVar 
for classical variables, ranged over by x, y, and qVar for quantum variables, ranged over by q,r, .... We 
assume a set Exp, which includes cVar as a subset and is ranged over by e, e', . ■ • : of classical data expressions 
over Real, and a set of boolean-valued expressions BExp, ranged over by b,b' , . . . , with the usual boolean 
constants true, false, and operators ^, A, V, and — >. In particular, we let e ixi e' be a boolean expression 
for any e,e' S Exp and txiG {>,<,>,<,=}■ We further assume that only classical variables can occur free 
in both data expressions and boolean expressions. Two types of channels are used: cChan for classical 
channels, ranged over by c,d,..., and qChan for quantum channels, ranged over by c,d,.... A relabelling 
function / is a map on cChan U qChan such that f{cChan) C cChan and f{qChan) C qChan. Sometimes 
we abbreviate a sequence of distinct variables gi, into q. 
The terms in qCCS are given by: 

P,Q ::= nil | t.P \ clx.P \ de.P \ clq.P \ d.q.P \ £[q].P \ M[q;x].P 
\ P + Q \ P\\Q I P[f] I P\L I if 6 then F | A{q;i) 
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where / is a relabelling function and L C cChan U qChan is a set of channels. Most of the constructors 
are standard as in CCS [28]. We briefly explain a few new constructors. The process clq.P receives a 
quantum datum along quantum channel c and evolves into P. The process c\q.P sends out a quantum 
datum along quantum channel c before evolving into P. The new symbols £ and M represent respectively a 
trace-preserving super-operator and a non-degenerate projective measurement applying on the Hilbert space 
associated with the systems q. 

Free classical variables can be defined in the usual way, except for the fact that the variable x in the 
quantum measurement M[q; x\ is bound. A process P is closed if it contains no free classical variable, i.e. 
fv[P) = 0. 

The set of free quantum variables for process P, denoted by qv[P) can be inductively defined as follows. 



qv{n\\) 


= 


qv{T.P) 


= qv{P) 


qv{clx.P) 


= qv{P) 


qv{c\e.P) 


= qv{P) 


qv{clq.P) 


= qv{P)-{q} 


qv{c\q.P) 


- qv{P)Li{q} 


qv{£[q].P) 


= qv{P) U q 


qv{M[q; x].P) 


= qv{P) U q 


qv{P + Q) 


= qv{P) U qv{Q) 


qv{P II Q) 


= qv{P) U qv{Q) 




= qv{P) 


qv{P\L) 


= qv{P) 


qv{i{ b then P) 


= qviP) 


qv{A{q;x)) 


= q- 



For a process to be legal, wc require that 

1. g ^ qv{P) in the process clq.P; 

2. qv{P) n qv{Q) = in the process P || Q; 

3. Each constant A(q;x) has a defining equation A{q;x) := P, where P is a term with qv(P) C q and 

MP) c i. 

The first condition says that a quantum system will not be referenced after it has been sent out. This is a 
requirement of quantum no-cloning theorem. The second condition says that parallel composition 1 1 models 
separate parties that never reference a quantum system simultaneously. 

Throughout the paper we implicitly assume the convention that processes are identified up to a-convcrsion, 
bound variables differ from each other and they are different from free variables. 

Wc now turn to the operational semantics of qCCS. For each quantum variable q wc assume a 2- 
dimensional Hilbert space "Hg. For any nonempty subset S C qVar we write Us for the tensor product 
space (S'ggs ^9- particular, 'H = HqVar is the state space of the whole environment consisting of all the 
quantum variables, which is a countably infinite dimensional Hilbert space. 

Let P be a closed quantum process and p a density operator on "H, the pair (P, p) is called a configuration. 
We write Con for the set of all configurations, ranged over by C and T). We interpret qCCS as a pLTS whose 
states are all the configurations definable in the language, and whose arrows are determined by the rules in 
Figure 1; we have omitted the obvious symmetric counterparts to the rules (C-Com), (Q-Com), (Int) and 
(Sum). The set of actions Act takes the form 

{civ, c\v I c e cChan, v G Real} U {c?r, c!r | c e qChan, r e qVar} 

The symbol r denotes invisible actions. We write Act,- for Act U {r}, which is ranged over by a. We use 
cn{a) for the set of channel names in action a. So, for example, cn{clx) = {c} and cn{T) = 0. 

In the first eight rules in Figure 1, the targets of arrows are point distributions, and we use the slightly 
abbreviated form C C to mean C C. 

The rules use the obvious extension of the function 1 1 on terms to configurations and distributions. To 
be precise, C || P is the configuration {Q \\ P, p) where C = {Q,p), and A || P is the distribution defined by: 



(A||P)((Q,p)) = 
Similar extension applies to A[/] and A\P. 



A{{Q',p)) if g = g' IIP 

otherwise. 
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(Tau) 

{t.P,p) ^ {P,p) 

(C-Outp) 

v = le] 

{de.P,p)^{P,p) 

(Q-inp) 

r ^ qv{c7q.P) 

(c?g.P,p) ^ {P[r/q],p} 

(Q-Cora) 

{P,,p)^{Pi,p) {P2,p)^{Pi,p) 
(Pi \\P^,p)^{Pi \\P^,p) 

(Meas) 

{M[q;x].P,p) E^eIP^(Pi>^^/^iElp^/P^) 

(Int) 

{Pi,p) ^ A qbv{a) n gz;(P2) = 

(Pl||P2,p)^A||P2 

(Rel) 

(P[/],p)^A[/] 

(Cho) 

(P, p) ^ A [6] = true 
(if b then P, p) ^ A 

Figure 1: Operational 



I! G Real 

(c?a:.P,p) ^ {P[v/x],p) 

(C-Com) 

{P,,p)^{Pi,p) {P,,p)^{Pi,p) 
{P,\\P2,p)^{Pi\\Pi,p) 

(Q-Outp) 

{c\q.P,p)^{P,p) 

( Oper) 



( Sum) 

(Pi,p)^A 

(Pl+P2,p) ^A 
(Res) 

(P, p) ^ A cnja) n P = 
(P\P,p)^A\L 

( Cons) 

{P[v/x,r/q],p) ^ A A{x,q):=P 
{A{v,T),p)^A 

semantics of qCCS 



5 Open bisimulations 

Let C = {P,p)- We use the notation qv{C) qv{P) for free quantum variables and ptr(C) trg„(p)(p) for 
partial traces. Let A = X^ie/Ps' ' {Pi^P^)- We write £{A) for the distribution J2ieiP>- ' (Pn^iPi))- 

Definition 5.1. A relation TZ C Con x Con is a strong open simulation ifC TZ T) implies that qv(C) — qv{T>), 
ptr(C) = ptr(2?), and for any E G SO{H ^,^^^,^ ) 

• whenever £{C) A, there is some distribution Q with £{'D) — ^ Q and A Ti) Q. 
A relation TZ is a strong open bisimulation if both TZ and TZ^^ are strong open simulations. 

The above definition is inspired by the work of Sangiorgi [36] , where a notion of bisimulation is defined 
for the TT-calculus by treating name instantiation in an "open" style. Here we deal with super-operator 
application in an "open" style, but the instantiation of variables is in an "early" style because the operational 
semantics given in Figure 1 is essentially an early semantics. For more variants of semantics, see e.g. [35]. 

In this paper we are mainly interested in a notion of weak open bisimulation which is like strong open 
bisimulation but internal transitions are abstracted away. 

Definition 5.2. A relation TZ C Con x Con is a weak open simulation if C TZ T> implies that qviC) = qv{T>), 
ptr(C) = ptr(P), and for any E G SO{H 
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• whenever £{C) A, there is some distribution Q with E{T>) =^ Q and A 7?.^ Q. 

A relation TZ is a weak open bisimulation if both TZ and TZ^^ are weak open simulations. We let «o be the 
largest weak open bisimulation. In the sequel we will simply use open bisimulation to refer to weak open 
bisimulation. 

Two quantum processes P and Q are bisimilar, denoted by P Q, if for any quantum state p G 'D{'H) 
and any indexed set v of classical values, we have 

{P{i/i},p) -o (Q{«/i},P>. 
Here x is the set of free classical variables contained in P and Q. 

5.1 A useful proof technique 

In Definition 5.2 super-operator application and transitions are considered at the same time. In fact, we can 
separate the two issues and approach the concept of open bisimulation in an incremental way, which turns 
out to be very useful when proving that two configurations are open bisimilar. 

Definition 5.3. A relation 72,C Con x Con is closed under super- operator application if C TZ V implies 
£iC) TZ £{V) for any £ G SO{n^). 

Definition 5.4. A relation TZQ Con x Con is a ground simulation if C TZ V implies that qv{C) = qv{T>), 
ptr(C) = ptr(2?), and 

• whenever C A, there is some distribution with T> =^ and A TZ^ O. 
A relation TZ is a ground bisimulation if both TZ and TZ^^ are ground simulations. 
Proposition 5.5. Suppose that a relation TZ 

1. is a ground bisimulation, and 

2. is closed under all super- operator application. 
Then TZ is an open bisimulation. 

Proof. Suppose that CTZV. Since TZis a. ground bisimulation, we have qv(C) = qviV) and ptr(C) = ptr(I?). 
Since TZ is closed under all super-operator application, we have £{C) TZ £{T>) for any £ e tS0("H ^^^g-j ). If 

£{C) A, then there exists some distribution 8 such that £{T>) Q and A TZ"^ 9 because 7?. is a ground 
bisimulation. Similarly, any transtion from £{T>) can also be matched up by £{C). Therefore, TZ is an open 
bisimulation. □ 

The above proposition provides us a useful proof technique: in order to show that two configurations 
C and T> are open bisimilar, it sufficies to exhibit a binary relation including the pair (C,I?), and then to 
check that the relation is a ground bisimulation and is closed under all super-operator application. This 
is analogous to a proof technique of open bisimulation for the 7r-calculus [36] , where name instantiation is 
playing the same role as super-operator application here. 

Proposition 5.6. is the largest ground bisimulation that is closed under all super- operator application. 

Proof. By definition «o is closed under all super-operator application. It is is obviously a ground bisimulation. 
Moreover, it is the largest one because of Proposition 5.5. □ 
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5.2 Equivalence and congruence 

As a sanity check, we prove that «o is an equivalence relation. This is based on the following transfer 
property. 

Proposition 5.7. Suppose A and A A' in a pLTS. Then there exists some distribution & such 
that e ^ e' and A' sa^t e'. 

Proof. Suppose A 6 and A A'. By Corollary 3.7, there is a finite index set / such that (i) 
A X^iG/P* ' (^^) ® ^ Eie/Pi ' (iii) ^» ~o for each i G /. By the condition A A', (i) and 

Proposition 3.5, we can decompose A' into X^ig/K ' ^'i fo^ some A^ such that Ci A^. By Lemma 3.3 
again, for each i € /, there is an index set J; such that A'^ = / lU ' ^'ij '^'^'^ each j G J; and 

Xjej, lij = 1- By (iii) there is some 9 such that ^ 6'^ and A'^- B-^-. Let 6' = Xie/jsj, PiQij-'^ij- 
Since is linear by Proposition 3.6, we know that 9 = Xig/Pi Xje-Zi lu'^i =^ B'- -l^y ^^e linearity of 
we notice that A' = (Xie/ Pi J2je.u Hj ' ^ij) ®'- ^ 

Corollary 5.8. Suppose A 9 and A =^ A'. T/ien t/iere is some 9' wii/i 9 ==> 9' anc? A' @'_ 

Proof. By Proposition 5.7 it is not difficult to show that 

(*) IfAKiJ Q and A' then there is some 9' with 9^9' anrf A' 9'. 

Suppose A =^ A' and A 9. If a is r then the required 9' follows by an application of property 

(*). 9therwise, by definition we know A =^ Ai, Ai A2 and A2 => A'. An application of property 
(*) gives a 9i such that 9 ==> 9i and Ai 9i. An application of Proposition 5.7 gives a 92 such that 
9i =^ 92 and A2 92. Finally another application of property (*) gives 92 ==> 9' such that A' q' 
The result now follows from the transitivity of ==^. □ 

Theorem 5.9. is an equivalence relation. 

Proof. It is trivial to see that is reflexive and symmetric. For transitivity, we show that • ~o is an open 
bisimulation relation. Since this is a symmetric relation, we only need to show that it is an open simulation. 
Suppose Ci ~o C2 and C2 ~o C3. If Ci — > Ai, then there is some C2 ^ A2 such that Ai ssot A2, since 
Ci ~o C2. From the condition C2 ~o C3 and Corollary 5.8 it follows that C3 A3 and A2 A3. By 
Proposition 3.8 we see that Ai • «o)^ A3 as required. □ 

As a relation between configurations, «o is preserved by all static constructors. 

Proposition 5.10. If {P, p) {Q,<^) then 

1. (P||i?,p)«o(g||i?,a); 

2. (P[/],p)«o(Q[/],fT); 

3. {P\L,p)^o{Q\L,a); 

4. (if 6 then P, p) «o (if b then Q, a) . 
Proof. We only prove (1) as an example. Let 

7^ = {((P||i^,p),(Q||i?,a)) I (P,p) (g,a)}. 

It suffices to show that TZ is an open bisimulation. Suppose {P\\R^ p)TZ{Q\\R,a) where {P,p) ~o {Q,cr)- By 
the definition of «o we have that qv{P) ~ qv{Q) and trg„(p)(/?) — trg„(Q)((T). Thus (7w(P||i?,) = qv{Q\\R) 
and we infer that 

tV(-P||-R)(/') = tV(-P||-R)\«f(-P)*V(-P)(^') = trgu(Q||-R)\g«(Q)trgt,(Q)(''') = ^^qv{Q\\R)i<^)- 
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By Proposition 5.6, we know that (P, £{p)) «o (Q, ^(c)) for any £ E SO{'H ^^f^p-^ ), from which it follows that 
(P II R,£{p)) TZ {Q II R,£{(j)) for any £ € 'SO{H ^^,^p^^p^ ). In other words, TZ is closed under super-operator 
application. Below we show that it is also a ground bisimulation. 

Suppose(P||P, p) A for some a and A. There are three cases to consider. 



1. The transition is caused by P solely; that is, {R, p) — ^ pi • (Pi, and A = • (P||Pi, . 

Then 

(Q||P,a) ^ e = • {Q\\R„£,{a)). 

i 

Furthermore, by Proposition 5.6, we have {P,£i{p)) sSq {Q,£i{o')), and then A TZ^ Q by definition. 



2. The transition is caused by P solely; that is, (P, p) — ^ Ai = p.; • (Pi, Pi), and A = Pi • (Pi||P, Pi). 

Since (P, p) ~o {Q,o-)- Then {Q,a) =^ 0i such that Ai ©i- By Proposition 3.5, we have the 
decomposition Qi = X^iK ' ®i with (Pi, pi) ©i for each i. So we have 



(Q||p,a) ^e = ^p, •ejp 



and A 7?.^ 8 by definition. 



3. The transition is caused by a communication between P and R. Without loss of generality, we assume 
that 

(P,p)^(P',p), (P,p) ^(P',p), 

and A = (P'||P',p). By a simple induction on the rules in Figure 1, it is easy to see that (P, ??) 
(P',7?) for any r] e V{H). 

From the assumption that {P, p) ~o (Q,"'), we have 

(Q,ct) ^ • {Q,,ai) 

such that for any i S /, it holds that {P',p) ~o {Qi,o'i) and 

(Q||P,a) ^e = ^K- (g,||P',a,). 

Furthermore, for any i € I, we have 

{{P'\\R\p),{Q^\\R',CT,))e^Z 

by definition. That is, A 7?.^ O as required. 

The symmetric form when {Q\\R,£{a)) — ^ © can be similarly proved. So 7?. is a ground bisimulation on 
Con. It follows from Proposition 5.5 that TZ is also an open bisimulation. □ 

Note that we do not have a counterpart of the above proposition for dynamic constructors such as prefix. 
As a counterexample, consider the following two configurations taken from [10]: 

(P,p) and {Q,p) 

where P = Mo,i[g; xj.nil with Afo,i = '^o[|0)] + Ai[|l)] being the 1-qubit measurement according to the 
computational basis, Q ~ /[g].nil, and p = [\0)]q (8) cr with a S VChq). We have that (P, p) ~o {Q,p), but 
{H[q].P,p) {H[q].Q,p) when H is the Hadamard operator. 

Nevertheless, as a relation between processes, ~o is preserved by almost all constructors of qCCS. 

Theorem 5.11. The relation «o between processes is preserved by all the constructors of qCCS except for 
summation. 

Proof. Similar to the proof of Theorem 6.17 in [10], which shows the congruence property of a notion of 
weak bisimulation. □ 
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5.3 An extensional equivalence 

We formally define three criteria, namely barb-preservation, reduction-closedness and composionality, in 
order to judge whether two processes are equivalent. This yields an extensional equivalence that turns out 
to coincide with open bisimilarity. 

Definition 5.12 (Barbs). For A e 'D{Con) and c G cChan let 

VciA) = ^{A(C) I C ^ for some v}. 

We write C i^^^ whenever C A for some A with Vc(A) > p. 
Definition 5.13. A relation TZ is 

• barb- preserving if C TZD implies that C i^^^ iff D JJ.^'' for any classical channel c; 

• reduction-closed if C TZV implies 

— whenever C A, there exists O such that D ==> O and A TZ^ Q, 

— whenever T) O, there exists A such that C A and A Ti) O; 

• compositional if C TZ V implies {C\\R) TZ {T>\\R) for any process R with qv{R) disjoint from qv(C) U 
qv{T>), and TZ is closed under super- operator application. 

Definition 5.14 (Reduction barbed congruence). Let reduction barbed congruence, denoted by be 
the largest relation over configurations which is barb-preserving, reduction- closed and compositional, and 
furthermore, if C k.^ T> then qv{C) = qv(T>) and ptr(C) = ptr(2?). 

Theorem 5.15 (Soimdncss). If C ^oT^ then C w,- T>. 

Proof. By Corollary 5.8 and Proposition 5.10 we know that «o is reduction closed and compositional. It 
remains to show that «o is barb-preserving. 

Suppose C ~o ^-^ and C-IJ.^^, for any classical channel c and probability p; we need to show that V]}-^^. 
We see from C JI^P that C =^ A for some A with Vc(A) > p. By Corollary 5.8, the relation «o is reduction- 
closed. Hence, there exists 9 such that V =!=> Q and A 0- The latter means that 

A = ^p, -cI «o2?, e = Y,p^■^^ (5) 

By the second part of (5), if Ci for some action civ, then T>i ^=^, that is T>i =^=> 0,; for some 
distribution 9i. Let Ic be the index set {i G I \ Ci for some v}, and Q' be the distribution 

C^P^■e,) + { P^■^)■ 

By the linearity and reflcxivity of =>. Proposition 3.6, we have e 8'. It follows from 2? ^ 9 6' 

that T> =!=> Q'. It remains to show that 14(9') > p. 

Note that for each z G /c we have 9; for some action civ, which means that Vc{Qi) = 1. It follows 
that 

Vc{e') = J:^eI^P^■Vcie^)+J:^eJ\I^P^■Vcm 

> E^^I^P^■Vcm 

~ ^ieia P^ 
= K(A) 

> P 

□ 
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In order to obtain completeness, the converse of Theorem 5.15, we make use of a proof technique that 
involves examing the barbs of processes in certain contexts; the following technical lemma enhances this 
technique. 

Lemma 5.16. //A||c!0 w,.^ e||c!0 where c is a fresh classical channel, then A ss^^ ©• 

Proof. Consider the relation 

7^= {{C,V) I C||c!0 «r for some fresh channel c} 

We show that TZQ^r- Suppose C TZV. Then there is a fresh channel c such that C||c!0 «r 2?||c!0. Let C ~ 
{P,p) and V = {Q,a). By the definition of we have qv{P\\clO) = gt;(g||c!0) and ptr(C||c!0) = ptr(X'||c!0), 
i.e. tr,„(p||c!o)(p) = trg„(Q||c!o)(o-)- Notice that 

qv{P) = gt;(P||c!0) = qv{Q\\dO) = qv{Q). 

It follows that 

ptr(C) trg„(p)(p) = tr,„(p||c!o)(p) = tr,„(Q||c!o)(CT) = ptr(2?). 
Below we check that TZ is compositional, barb-preserving and reduction-closed. 

1. TZ is compositional. For any process R with qv{R) disjoint from qv{C) and c fresh for R, since is com- 
positional, we have (C||c!0||i?) (2^l|c!0||i?), which means (C||i?) TZ {T>\\R). By the compositionality 
of «r we also have £{C \ \ c!0) £{V \ \ c!0) for any £ e 50 ("H^^^^^p^) . Since qv{C) = qv{C \ \ c!0), we 
have £ € SO{H-^:^). Note that 

£{C) II c!0 = £{C II c!0) £{V \\ c!0) = £{V) \ \ c!0. 
It follows that £{C) TZ £{T>) and thus TZ is closed under super-operator application. 

2. 7^ is barb-prcserving. Suppose C i}-^^ for some channel Ci and probability p. Let C2 be some fresh 
channel. We construct the process T by letting 

T — ci7xi.c?x.C2lO 

for any xi and x. Since ~r is compositional, we have (C || c!0 || T) w,,, (2? || c!0 || T). Note that 
(C II c!0 II T)4|P, which implies || c!0 || T)i^~P. Since c is fresh for V, the latter has no potential 
to communicate at channel c. Therefore, it must be the case that T>i^^^. 

3. TZ is reduction-closed. Suppose C A for some distribution A. Then C||c!0 A||c!0. bmce 

(C||c!0) Rir m\clO), there is some F such that V\\clO ^ F and (A||c!0) w^^^ F. Note that c is fresh for 
P, thus there is no communication between I) and c!0. Therefore, it must be the case that F = 9||c!0 

for some 9 such that X> =^ 9. Thus, (A||c!0) ^^r'' (0||c!O), i.e. A TZ'' 9. 

□ 

Theorem 5.17 (Completeness). IfC then C ~o 'D. 

Proof. Since is closed under any super-operator application, by Proposition 5.5 it suffices to show that 
~r is a ground bisimulation. By the symmetry of we only need to show that is a ground simulation. 
Suppose C = {P,p), T> = (Q,<t) and C ~r 'D. By definition, we have qv{P) ~ qv{Q) and tr^.„(p')(/9) = 
tr qy(^Q-){a). Suppose C A. We distinguish several cases. 

1. a = T. Since is compositional, we have (C || c!0) (I? || c!0) for some fresh channel c. Since «r is 

reduction-closed, the reduction C || c!0 A || c!0 is matched by some F such that 2? || c!0 ^» F and 
A II c!0 F. Since c is fresh, there is no communication between T> and c!0, so it must be the case 

that F has the form 9 || c!0 with T> =^ 9. It follows from Lemma 5.16 and A || c!0 9 || c!0 that 
A 9. 
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2. a = civ. Let T be the process defined by 

T := ci!0 + c?x.if X = w then (calO + r.calO) 

where ci,C2 and C3 arc fresh channels. Then C\\T Aljcs!?;. 

Since C ~r 2? we know C\\T by the compositionality of w^- Since ~r is reduction-closed, there 

is some F such that 2?||T =^ F and A||c3!0 T- Since is barb-preserving we have F jj^^^", F 
and F-lJ-ii,^- Here we use the notation F to mean that F-IJ.^^^ does not hold for any p > 0. It must 

be the case that F = 8||c3!0 for some 9 with T) Q. By Lemma 5.16 and AjlcalO ©HcslO, we 
have A ©• 

3. a = c7q. Let T be the process defined by 

T := ci!0 + c!r.C2!0 

where ci and C2 are fresh channels. Then C||T =^ A || calO. Since C ~r 2? we know C\\T 2?||T by 

the compositionality of w^- Since ~r is reduction-closed, there is some F such that V\\T ^ T and 

A||c2!0 ~r T- Since «r is barb-preserving we have F J(l-^^ and FJJ-^/- It follows that 2? ==^ and 
F = 6 II C2IO, with implicit assumption of a-conversion. By Lemma 5.16 and A || C2IO 6 || czIO, 
we have A ©■ 

The case when a = c?x is similar. 

4. a = c!g. Let T be the process defined by 

T ci!0 + c?r.(c2!0 + /H.C3!0) 

where ci , C2 and C3 are fresh channels. Then C||r =^ A || (c2!0 -h /^.calO). Since C ~r we know 
C||T «r f ||r by the compositionality of Since ~r is reduction-closed, there is some F such that 
I?||r ^ F and 

A||(c2!0 + /[(7].c3!0)«,.tF. (6) 

Since is barb-preserving we have F jj-;?^" and T . It follows that V 8 for some q' G qVar, 
and F = e II (c2!0 -f- /[g'J.csIO). Note that A||(c2!0 + l[q].ca\0) A||c3!0. To match this action, we 
have F ^ F' for some F' such that A||c3!0 ^r'^ F'. As a consequence, we have F'4|^ but F' 

so F' = 6' II C3IO for some 8' with Q Q', which implies V Q'. Now by Lemma 5.16 and 
A II cglO 9' II cglO, we derive A e'. 

Finally, we claim that q = q' . Otherwise from Eq.(6), we know q' e qv{/S) but q' ^ qv{Q). That 
contradicts the fact that A||c3!0 T' as qv{Q') C qv{Q). 

□ 

5.4 Modal characterisation 

We extend the Hennessy-Milner logic by adding a probabilistic choice modality to express the behaviour of 
distributions, as in [7], and a super-operator modality to express trace-preserving super-operator application, 
as well as atomic formulae involving projectors for dealing with density operators. 

Definition 5.18. The class C of modal formulae over Act, ranged over by (j), is defined by the following 
grammar: 

^ EfP\A,^jCl>,\{a)i;\^cl,\£.cb 
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where a G Actr, £ is a super- operator, and E is a projector associated with a certain subspace ofHq. We 
call (f> a configuration formula and ijj a distribution formula. Note that a distribution formula only appears 
as the continuation of a diamond modality {a)ip. 
The satisfaction relation |=:C S x C is defined by 

• C\= EfP if qv{C) n g = and tr{Eqp) > p where C = (P, p) . 

• C h Aiei 't't «/C 1= 01 for all i G /. 

• C \= {a)ip if for some A G D^Con), C A and lS.\= ijj. 

• C 1= -^(j) if it is not the case that C \= <j). 

• C^£4ifEe SOin^) and £{C) h 

• A ^ ©ig/K ■ 4'i */ there are A^ G 'D{Con), for all i G 1,1) G with T) \= (pi, such that A = 

With a slight abuse of notation, we write A |= above to mean that A satisfies the distribution formula 
ifj. A logical equivalence arises from the logic naturally: we write C =^ 'DiiC\=(j>4^'D\=(j) for all G £. 
It turns out that C is adequate with respect to open bisimilarity. 

Theorem 5.19. Let C and D be any two configurations in a pLTS. Then C ~o 2? if and only if C =^ T>. 

Proof. Suppose C ~oT^, we show that C \= (j) <^ T> \= (p. Since ~o is symmetric, it suffices to prove that 
C \= 4> implies 2? |= by structural induction on (f). 

• Let C h Ef'P. Then qv[C) n g = and ty[Eqp) > p. Since C P, we have qv{C) = qv{V) and 
ptr(C) = ptr(2?). Thus qv{V) n g = 0. Let C = (P, p) and V = (Q, a). We can infer that 



tr{Eqa) = tr^^tr,^(Q)(£:qCr) 

(Qj£'g(tV(Q)('^)) 



qv 

= tr^^£^,-(tr,„(P)(p)) 
= tr^^tr,„(p)(i;,-p) 

> P- 

It follows that V \= EfP. 

• Let C \= Ate/ ^'i-' Then C |= pi for each i G /. So by induction I? 1= 0^, and we have V |= Aie/ 

• Let C \= -^<f>. So C ^ (/), and by induction we have V ^ (p. Thus V \= ^(p. 

• Let C 1= (a) 0,,gjPt • pi- Then C =^ A and A \= 0,gjPt • pi for some A. So A = J^ieiPi ' ^» and 
for all i G / and C G [A^] we have C \= <pi. Since C 1^-, by Corollary 5.8 there is some O with 

v=^e and A e. Since the lifted relation is left-decomposable, we have that Q = J2ieiPi ' 
and Ai it follows that for each V G there is some C G [Aj] with C «o 'D' - So by 

induction we have V ^ p)i for all V G [8^] with i G I. Therefore, we have 8 \= ©jg/ Pi - (pi- It follows 
that V [= (a) 0,gjPt • 

• Let C h Then £ G ^OC^^^) and f (C) \= (p. Since C 2?, we have f (C) £{'D) by 
Proposition 5.6 and qv{C) = qv{V). By induction, we have £{T>) |= 0. It follows that V \= £.p. 
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(■^) Suppose C =^ v. We first show that qv{C) = qv{'D) and ptr(C) = ptr(X'). For any g, if qC^qv{C) = 
then C h -ff^- Since C =^ I? we have V |= /|\ and thus q D qv{V) = 0. It follows that qv{C) D qv{V). 
By the symmetry of this implies qv{C) = qv{'D). Now let C = (P, p) and V = {Q,a). Suppose for 
a contradiction that trq,„(-p)p 7^ tr^^^pjcr. Then there exists a projection E on q with ^ H qv{P) = and 

tr(£'qcr) < tT{Eqp). Let p = tr{Eqp). Then (P, p) |= i?^^ while (Q,cr) -S'^^, contradicting the assumption 
that C =^ V. 

Next, we show that the relation =^ is a ground bisimulation. Suppose C V and C A. We have 
to show that there is some e with 2? ^ e and A 6. Consider the set 

T:={e|P^eAe= J2 MC')-ec' ABC e\A],3V' elOc] -.C ^^V} (7) 

For each 8 G T, there must be some Cq G [A] and 2?q e [©c^l such that (i) either there is a formula 0e 
with C'q 1= (pQ but I?Q ^ 0e (ii) or there is a formula 0^ with ^ but Cq ^ • In the latter case we 
set 0e = and return back to the former case. So for each C E [A] it holds that C |= A{eeT|c' =C'} "^9 
and for each 8 S T with Cq = C there is some V'q G [8c'] with Vq ^ A{eeT|c' =C'} -'^'-'^ 

0:=(c.) A(C')- A '^e. (8) 

c'eTA] {eeT|c^=c'} 

It is clear that C 1= 0, hence V \=: (j) hy C ~'~ V. It follows that there must be a 8* with V =5^ 8*, 
8* = EcefAl ^(<^') ■ ©C' and for each C e \A'],V' e [85,] we have V ^ A{eeT|c^=C'} '^e- This means 

that 8* ^ T and hence for each C £ [A],!?' G [8^,] we have C =^ X>'. It follows that A (=^)^ 8*. By 
symmetry all transitions of V can be matched up by transitions of C. 

Finally, we prove that the relation =^ is closed under super-operator application. That is, for any 
£ G tS0(H ^,^^g-j ) we need to show that C T) implies £{C) ='~ £{T^)- Suppose C ='~ T) and let 4> be any 

formula such that £{C) \= (p. We have C \= E.cj). It follows from C =^ T) that qv{C) = qv{T>) and V \= £.(/). 
Therefore, we obtain \= 0. By symmetry if (p is satisfied by f (2?) then it is also satisfied by £{C). In 

other words, we have £{C) =^ £{T^)- 

Now by appealing to Proposition 5.5 we see that is an open bisimulation, thus =^ C k.^. □ 

Note that the set T in (7) is infinite in general as T) may have infinitely many different derivatives, hence 
we have to use infinite conjunction in (8). This is the reason that we cannot restrict ourselves to finite or 
binary conjunction in Definition 5.18. 

6 Examples 

BB84, the first quantum key distribution protocol developed by Bennett and Brassard in 1984 [2], provides 
a provably secure way to create a private key between two parties, say, Alice and Bob. Its security relies 
on the basic property of quantum mechanics that information gain about a quantum state is only possible 
at the expense of changing the state, if the states to be distinguished are not orthogonal. The basic BB84 
protocol goes as follows: 

(1) Alice randomly creates two strings of bits Ba and Ka, each with size n. 

(2) Alice prepares a string of qubits g, with size n, such that the ith qubit of q is \xy) where x and y are 
the ith bits of Ba and Ka, respectively, and |Oo) = |0), |0i) = |1), |lo) = |+), and |li) = |— ). Here the 
symbols 1+) and |— ) have their usual meaning: 

1+) = (|0) + \l))/V2 and I-) = (|0) - |l))/^/2. 
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(3) Alice sends the qubit string q to Bob. 

(4) Bob randomly generates a string of bits Bb with size n. 

(5) Bob measures each qubit received from Alice according to a basis determined by the bits he generated: 
if the ith bit of Bt is k then he measures with {|A;o), l^i)}, fc = 0, 1. Let the measurement results be 
Kb, which is also a string of bits with size n. 

(6) Bob sends his choice of measurement bases Bb back to Alice, and upon receiving the information, Alice 
sends her bases Ba to Bob. 

(7) Alice and Bob determine at which positions the bit strings Ba and Bb are equal. They discard the bits 
in Ka and Kb where the corresponding bits of Ba and Bb do not match. 

After the execution of the basic BB84 protocol above, the remaining bits of Ka and Kb, denoted by K'a 
and if^ respectively, should be the same, provided that the channels used are perfect, and no eavesdropper 
exists. 

To detect a potentially existing eavesdropper Eve, Alice and Bob proceed as follows: 

(8) Alice randomly chooses [fc/2], where k is the size of K'a, bits of K'a, denoted by K'a, and sends Bob 
K'a and their indexes in the original string K'a- 

(9) Upon receiving the information from Alice, Bob sends back to Alice his substring K'^l of according 
to the indexes received from Alice. 

(10) Alice and Bob check if the strings K'a and K^^ are equal. If yes, then the remaining substrings Kl 
(resp. kI) of K'a (resp. K'b) by deleting K'a (resp. K'^') are the secure keys shared by Alice and Bob. 
Otherwise, an eavesdropper is detected, and the protocol halts without generating any secure keys. 

For simplicity, we omit the processes of information reconciliation and privacy amplification. Now we 
describe the above protocol in our language of qCCS. To ease the notations, we assume a special measurement 
Ran[q; x\ which can create a string of n random bits, independent of the initial states of the q system, and 
store it to x. In effect, Ran[q;x\ ~ Set^lq].!^!^ i[q; x\.Set^[q\. Then the basic BB84 protocol can be defined 
as 

Alice "^^ Ran[q; Ba] .Ran[q; ka].Setj^^ [q] .Hg^ [q] .A2B\q.WaitAiBa , Ka) 
WaitAiBa,Ka) b2aWb.a2h\Ba.keya\cmp{ka,Ba,Bb).n\\ 

Boh A2B?qMan[q']Bb].M^Jq;Kb].b2a\Bb.WaitB{Bb,kb) 
WaitB{i3b,kb) =^ a2b?Ba.keyblcmp{Kb,I3a,I3b) -nil 

BBM =^ {Alice\\Bob)\{a2b,h2a,k2B} 

where Sef\_ is the super-operator which sets each of the n qubits it applies on to |+), My[q;Kb\ is the 
quantum measurement on q according to the basis determined by y, i.e., for each 1 < k < n, it measures qk 
with respect to the basis {|0), |1)} (reps. {|+), |— )}) if y{k) = (resp. 1), and stores the result into Kb{k). 
Mqi is the same as Mq...q, and Hy[q] has a similar meaning with My[q; Kb]. We also abuse the notion slightly 

by writing £g[q].P when we mean X]i;=o"('^ B = x then fj[g].P) where 0" is the all zero string of size n. 
The function cmp takes a triple of strings x, y, z with the same size as inputs, and returns the substring of x 
where the corresponding bits of y and z match. When y and z match nowhere, we let cmp{x, y, z) = e, the 
empty string. 
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BB84 




Figure 2: pLTSs for BB8A and BBMspe 

To show the correctness of this basic form of BB84 protocol, we have two choices. The first one is to 
employ the concept of bisimulation. Let 

BBiAgpc Ran[q]Ba\-Ran[q\K}j]Man[q'\Bi,]. 

{keyJcmp{Kb, Ba, i?(,).nil||fce2/fc!cTOp(^(,, Ba, Bb).r\\\). 

The pLTSs of BBSA and BBSAgpe for the special case of n = 2 can be depicted as in Figure 2, where for 
simplicity, we only specify the branch where Ba = Ka = 00. Each arrow in the graph denotes a sequence of 
T actions, and all probabilistic distributions arc uniform. The strings at the bottom line are the outputs of 
the protocol. Then it can be easily checked from the pLTSs that BBSA BBSigpe- The key is, for each 
extra branch in BBSA caused by the measurement of Bob (the Ki, line), the final states are bisimilar; they 
all output the same string. 

The second choice is to use logic formulae. Let 

TestBBM =^ (BBSAWkeyalKa-keyb^Ki 

(if K'a = K'b then suclO.nil else faillQ))\{keya, keyb}, 

and 

ipp ~ {suc\0)true A -^{t){p ■ {faiUO)true + {1 — p) ■ true) 
where true is the abbreviation of AieB It is not difficult to show TestBBSA |= Vp for any p > 0. 
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Now we proceed to describe the protocol where an eavesdropper can be detected. 

Alice' (AliceWkeyJK'^.Pstr^j^, , [qa] x].a2b\S:.a2b\SubStr{K'^, S:).b2a7K'^. 

(if SubStr{K'^,S:) = K'^' then key'JRemStr{K'^,i). nil 

else alarnialO ■niV)))\{keya} 

Bob' =^ {Bob\\keyb?K'i,.a2blS:.a2blK'^.b2a\SubStr{k'f„i). 

(if SubStr{K'i„S:) = K'^ then k ey'^,] Rem S tr {K 'i„ i). nil 

else alar'mi,l0.nil))\{keyb} 

BBM' Alice' \\ Bob' 

where \x\ is the size of x, the function SubStr{K'^,x) returns the substring of K'^ at the indexes specified 
by X, and RemStr{K'^,x) returns the remaining substring of K'^ by deleting SubStr{K'^,x). The special 
measurement Pstr,ri., which is similar to i?an, randomly generates a [m/2] -sized string of indexes from 
1, . . . ,m. 

For the capacity of a potential eavesdropper Eve, we assume that she has complete control of the quantum 
channel, but can only listen on the classical channels between Alice and Bob. That is, she can do any quantum 
operations on the communicated qubits from Alice and Bob, one of the extreme cases being keeping the qubits 
from Alice while creating and sending to Bob some fresh ones, with the same size, prepared by herself. But 
for classical communication. Eve can only copy and resend the bits without altering them, since Alice and 
Bob can choose to send them through a broadcasting channel. Note that perfect copying of the qubits 
transmitted through the quantum channel from Alice to Bob is prohibited by the basic laws of quantum 
mechanics, since the potential quantum states sent, |0), 1+), and |— ) in this protocol, are nonorthogonal. 
With these natural assumptions, an eavesdropper Eve can be described as: 

Eve k2£lq£[q'',q]MlS''-J<e]-^2^\q-WaitE{ke) 

WaitE{Ke) b2e7Bb.e2alBfa2elBa.e2blBa.a2elx.e2b\x. 

a2elk'^.e2b\k'^.b2e'lk'^.e2a\k'^.key'J.gkey{k,, B^, Ba, K, k'^, i) rnl 

where £ is a super-operator, and gkey is the function Eve used to generate her guess of the key from the 
classical information transmitted between Alice and Bob. Then a practical running BB84 protocol, with the 
existence of an eavesdropper, goes as follows 

BBMe '^^ {Alice'[fa]\\Eve\\Bob'[h])\{a2e,b2e,e2a,e2b,^2£, E2B} 

where fa and fb are relabelling functions such that fa{a2b) = a2e, fa{b2a) — e2a, /a(A2B) ~ A2E, and 
fb{a2b) = e2b, fb{b2a) = b2e, /(,(A2B) ^ E2B. 

To get a taste of the security of BB8A', we consider a special case where Eve's strategy is to simply 
measure the qubits sent by Alice, according to randomly guessed bases, to get the keys. She then prepares 
and sends to Bob a fresh sequence of qubits, employing the same method Alice used to encode keys, but 
using her own guess of bases and the keys she obtained. That is, we define 

Eve' =^ A2E7 q.Ran[q"; Be].M^^ [q; ke].Setf.^ [q\-HB, [q].E2mq.WaitE{k,) 

Now let BB8A'^ be the protocol obtained from BBSAe by replacing Eve by Eve', and letting the function 
gkey simply return its first parameter. Let 

TestBBM' {BBM'E\\key'Ji.key'bly.key';^z.{ii i ^ y then faiV.Q.nil 

else fceye!z.sfcey!.T.nil))\{fcey^, key'b, key'^}. 
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It is generally very complicated to prove the security of the full BBSA protocol, even for the simplified 
Eve' presented above. Here we choose to reduce TestBBSA' to a simpler process which is easier for further 
verification. To be specific, we can show that TestBBSA' is bisimilar to the following process: 

TB Ran[q] Ba]-Ran[q; Ka]-Ran[q'' ; Be]-Ra'n''g ^ ^ [q; Kf;]-Ran[q' ; Bi,]- 

^^'^'b^,b,,k^ [9; Kb].Pstr^^^^^[qa;x]. 
(if Kab ~ Kba then keye\Ke.skey\RemStr{Kab,S:).nil 

else (if 7^ ^ba then alarmal0.ni\\\alarmbl0.nil 
else faillO.nil)) 

where to ease the notations, we let Kab = cmp{Ka, Ba, Bb), K^a = c'mp{Ki,, Ba, Bb), K^f^ = SubStr{Kab, x), 
and K^^ = SubStr{Kba,S:). Similar to Ran^ the special measurement Ran' here, which takes three param- 
eters, delivers a string of n bits. For example. Rang g ^ [q;Ke] will first generate a string of n — \Kae\ 
random bits x, replace with x the substring of Ka at the positions where Ba and B^ do not match, and store 
the string after the replacement in K^. 

7 Conclusion and related work 

In our opinion, bisimulations should be considered as a proof methodology for demonstrating behavioural 
equivalence between systems, rather than providing the definition of the extensional behavioural equivalence 
itself. We have adapted the well-known reduction barbed congruence used for a variety of process calculi 
[20, 32, 11, 5], to obtain a touchstone extensional behavioural equivalence for quantum processes considered 
in [10]. In the literature there are also minor variations on the formulation of reduction barbed congruence, 
often called contextual equivalence or barbed congruence. See [11, 35] for a discussion of the differences. 

We have defined a notion of open bisimulations, which provides both a sound and complete coinductive 
proof methodology for establishing the equivalence between qCCS processes. The operational semantics of 
this language is given in terms of probabilistic labelled transition systems. Moreover, we have generalised 
Hennessy-Milner logic to express the behaviour of quantum processes. In the resulting quantum logic, logical 
equivalence coincides with open bisimilarity. 

To conclude this paper, we would like to compare the open bisimulation defined here with other bisim- 
ulations for quantum processes already proposed in the literature. Jorrand and Lalire [25, 27] defined a 
branching bisimulation for their QPAlg, which identifies quantum processes whose associated graphs have 
the same branching structure. However, their bisimulation cannot always distinguish different quantum op- 
erations, as quantum states are only compared when they are input or output. More seriously, the derived 
bisimilarity is not a congruence; it is not preserved by restriction. Bisimulation defined in [9] indeed dis- 
tinguishes different quantum operations but it works well only for finite processes, since quantum states are 
compared after all actions have been performed. Again, it is not preserved by restriction, and whether it is 
preserved by parallel composition still remains open, although the positive answer is affirmed in two special 
cases. In [41], a congruent (strong) bisimulation was proposed for a special model where no classical datum 
is involved. However, as many important quantum communication protocols such as superdense coding and 
teleportation cannot be described in that model, the scope of its application is very limited. Furthermore, 
as all quantum operations are regarded as visible in [41], the bisimulation is too strong; it distinguishes two 
different sequences of quantum operations even when they have the same effect as a whole. 

The first general (works for general models where both classical and quantum data are involved, and 
recursive definition is allowed), weak (quantum operations are regarded as invisible, so that they can be 
combined arbitrarily), and congruent bisimulation for quantum processes was defined in [10]. It differentiates 
quantum input, to match which an arbitrarily chosen super-operator should be considered, from other actions. 
The open bisimulation in this paper makes a step further by treating the super-operator application in an 
'open' style: applying super-operators before an action to be matched is selected. This makes it possible to 
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separate ground bisiraulation and the closedness under super-operator application, and by doing so, we are 
able to provide not only a neater and simpler definition, but also a powerful technique for proving bisimilarity. 

It is easy to prove that the bisimulation in [10] is both a ground bisimulation and closed under super- 
operator application. Then by Proposition 5.5, it is also an open bisimulation; in other words, the bisimilarity 
presented in the current paper is coarser than that defined in [10]. Whether or not they arc actually the 
same is an interesting question, and we leave it for further investigation. 
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